Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: They're not perfect but they're getting better

ncsc.gov.uk

Post reply on HN
Print view View original

91–100 of 145 posts

Re: Passkeys: They're not perfect but they're getting better

#91

Post by FreakLegion »

commandersaki wrote: post #85
FreakLegion wrote: post #81

Earlier quoted context omitted.

Correct, individual sites could make that choice. They won't, but they could. (Love the mention in the linked comment of Netflix and Disney, two services that don't even support proper MFA.) We're completely on the same side, to be clear. I just have zero fear of KeePassXC (which I sometimes use with Okta!) being blocked by anything consumer-facing.

Apple does precisely this for Apple account, you need to have a hardware attested passkey implementation to authenticate using passkey. Edit: forgot to add Apple account

To authenticate to what? I have a few dozen people using passkeys on macOS without attestation, but I'll admit none of them are logging into "Apple".

Re: Passkeys: They're not perfect but they're getting better

#92

Post by vivzkestrel »

if you really want passkeys to succeed why not implement it at the browser level. Basically everytime you visit a new website the browser has never seen before, the browser initiates a handshake of sorts with that website and secures a passkey for it which is stored. If the user wants to log in to that website, the browser can automatically patch in the details as and when required

Re: Passkeys: They're not perfect but they're getting better

#93

Post by hollow-moe »

Websites can choose to not accept your passkey manager ("accept" not "block" since it will obviously be enforced as whitelist). What could possibly go wrong ? If only there was a similar example with an existing system like TOTP and a big company like Steam.......... Link unrelated https://github.com/keepassxreboot/keepassxc/discussions/9591 Eventually get debanked and go live in the woods ig

Re: Passkeys: They're not perfect but they're getting better

#94

Post by geonineties »

stavros wrote: post #82
array_key_first wrote: post #79

Earlier quoted context omitted.

The danger is that you now can no longer use netflix without they're approved hardware? Of course, that's essentially already the case with netflix, but this becomes dicey when services that actually matter take this approach. And then suddenly you're debanked.

No, we're talking about logins, not usage. Can someone explain to me a case where logging in only with an approved authenticator would be problematic?

How exactly are you going to use a service that requires login if the login requires an authorized device you don't have?

Re: Passkeys: They're not perfect but they're getting better

#95

Post by stavros »

geonineties wrote: post #94
stavros wrote: post #82

Earlier quoted context omitted.

No, we're talking about logins, not usage. Can someone explain to me a case where logging in only with an approved authenticator would be problematic?

How exactly are you going to use a service that requires login if the login requires an authorized device you don't have?

OK, so what's the scenario? Netflix wants to make me not use their service? Surely there are easier ways to do that than to make a new auth standard?

Re: Passkeys: They're not perfect but they're getting better

#96

Post by throwawayffffas »

ajnin wrote: post #35

> websites which [...] also want to know how the passkey is being handled by the user’s device to keep their accounts safe This is exactly where passkeys go too far. "to keep their accounts safe" is always the excuse used to reduce the freedoms of users. Web sites have no business deciding how things are handled on user devices but it's precisely what passkeys enable. The boundary of control of a website used to stop…

Yep the whole tpm thing and the device constrained nature they have envisioned is the major drawback.

But no they have to live in their secured enclave or on a dongle so that you can't copy them between devices because nothing ever happened to a device.

As if the rest of the users system is compromised the user can't be tricked into providing access to their account.

And no one ever "recovered" someone else's account.

The main benefit of passkeys is that they are keys you don't have to send them over the wire. The main risk of having them on disk encrypted purely in software is that a compromised system can lead to the keys getting stolen.

Their trusted platform bulshit doesn't really escape that threat though, instead of stealing your keys the attacking malware can just get access to your service and maybe even enroll their own key.

If you tried to login to a website and you got two requests to allow the use of your key one after the other would you really have the wherewithal to say no wait a second I just gave permission for that key to be used, the second request is obviously from malware on this computer that's trying to gain access to my account.

That's ignoring that the malware can just read everything you are reading.

The whole tpm obsession is security theater on top of a power play

Re: Passkeys: They're not perfect but they're getting better

#97

Post by throwawayffffas »

stavros wrote: post #95
geonineties wrote: post #94

Earlier quoted context omitted.

How exactly are you going to use a service that requires login if the login requires an authorized device you don't have?

OK, so what's the scenario? Netflix wants to make me not use their service? Surely there are easier ways to do that than to make a new auth standard?

It's not really Netflix. Its Microsoft, Apple and Google.

So say goodbye to using teams on Linux. Using Microsoft365 on any hardware that is not Microsoft approved.

Or logging in to your bank without an iPhone or an android. We will surely complain but the bank will say that we only support secure devices and that means iPhones and Android, and how come you are making a big deal about it just buy one of these two everyone else has one.

Re: Passkeys: They're not perfect but they're getting better

#98

Post by throwawayffffas »

stavros wrote: post #76
0cf8612b2e1e wrote: post #16

Earlier quoted context omitted.

Also requires the device allows backup of passkeys. The infamous post where keepass was threatened if they were to continue to allow users to backup their own keys.

The person there requested that KeePassXC don't let users export their keys in plaintext , which seems reasonable. He asked that the software encrypt the keys with a user-selected password before exporting, so someone stealing the files wouldn't have the keys to literally all of the user's sites. That doesn't seem unreasonable to me.

Not really dude, if I can't export in plaintext I can't pick the encryption I have to use whatever keepassxc will do. I can't pipe it to gpg and encrypt it with my key.

And on the other hand I can only load them to another keepass instance I can't switch credential managers.

If you are worried your system is running malware that will steal your plaintext keys, well bad news they can steal the encrypted keys and keylog your password.

Re: Passkeys: They're not perfect but they're getting better

#99

Post by throwawayffffas »

foobazgt wrote: post #44
torstenvl wrote: post #31

Earlier quoted context omitted.

Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.

At first I read this as "Apple doesn't implement Touch ID, because they found it to be insecure", which really confused me. Was that the intent? On second reading, I'm thinking this might mean, "since Apple only implements Face ID, biometrics on Apple devices is less secure", which makes more sense (to me).

Aren't fingerprints obsolete as biometrics? Last I remembered fingerprints can be lifted if high resolution pictures. I.e. any picture where your thumb is visible.

Re: Passkeys: They're not perfect but they're getting better

#100

Post by joshuamorton »

throwawayffffas wrote: post #97
stavros wrote: post #95

Earlier quoted context omitted.

OK, so what's the scenario? Netflix wants to make me not use their service? Surely there are easier ways to do that than to make a new auth standard?

It's not really Netflix. Its Microsoft, Apple and Google. So say goodbye to using teams on Linux. Using Microsoft365 on any hardware that is not Microsoft approved. Or logging in to your bank without an iPhone or an android. We will surely complain but the bank will say that we only support secure devices and that means iPhones and Android, and how come you are making a big deal about it just buy one of these two eve…

> Or logging in to your bank without an iPhone or an android.

This is already possible (and common!) many banking apps, for better or worse, use device attestation features that require varyingly official copies of android. Were you already complaining about this?

Post reply on HN